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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1. (Currently Amended) A method of exchanging user-specific data from a mobile 
network to a service application of an external service provider, wherein certain user data is 
needed by the application for providing a requested service to a mobile user, the method 
comprising the following acts performed by a data control server of the mobile network: 

receiving a service request from the mobile user directed to the service application; 

generating a unique Application User Identification (AUID) random code which is 
assigned to a combination of the mobile user and the service application when the mobile 
user has not previously accessed the service application; 

sending the service request and the assigned AUID code to the service application, 

receiving from the application a request for the user data of said mobile user, 

checking in a permission table whether the service application is allowed to receive 
the requested user data, said permission table specifying a plhR-4ph tlu\ of mJlx i\ 
service applications and a type of data each individual application is allowed to receive, 

allowing the service application to receive the requested user data if said assigned 
AUID code was included in the received user data request and if the service application is 
allowed to receive the user data according to the permission table, 

retrieving the requested user data based on the received AUID code and sending the 
user data to the application, and 

the service application using the assigned AUID code to obtain the user data in 
conjunction with any subsequent service request from the mobile station. 

2. (Previously Presented) A method according to claim 1, wherein the AUID code is 
generated in response to receiving the service request from the mobile user. 
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3. (Previously Presented) A method according to claim 1, wherein the AUID code is stored 
in a translation table together with an identity of the mobile user and an identity of the 
service application. 

4. (Previously Presented) A method according to claim 3, wherein the mobile user identity is 
obtained from the translation table based on the received AUID code, for retrieving the 
requested user data from a user data base in which user-specific data is stored for mobile 
users being registered in the mobile network. 

5. (Previously Presented) A method according to claim 1, wherein the AUID code is used by 
the service application for attributing the retrieved user data sent to said service upon 
subsequent access of the mobile user to the same service. 

6. (CANCELLED) 

7. (Currently Amended) A method according to claim 61 , wherein a permission table is 
maintained for a specific user or group of users. 

8. (Currently Amended) A method according to claim §]., wherein an error message is sent to 
the service application if the service application is not allowed to retrieve the requested user 
data. 

9. (Previously Presented) A method according to claim 1, wherein new AUID codes are 
generated by dividing the decimal representation of a non-periodic irrational number into 
blocks of a certain length, wherein each block is used as an AUID code. 

10. (Previously Presented) A method according to claim 1, further comprising determining 
whether a valid mobile user identity exists that corresponds to the received AUID code in 
order to check if the application is authorised. 
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11. (Currently Amended) A data control server for exchanging user-specific data from a 
mobile network to a service application of an external service provider, wherein certain user 
data is needed by the application for providing a requested service to a mobile user, the data 
control server comprising: 

- means for receiving a service request from the mobile user directed to the service 
application, 

- means for generating a unique Application User Identification (AUID) random code 
which is assigned to a combination of the mobile user and the service application when the 
mobile user has not previously accessed the service application, 

- means for sending the service request and the assigned AUID code to the service 
application, 

- means for receiving from the service application a request for user data of the mobile 
user, 

means for checking in a permission table whether the service application is allowed to 
receive the requested user data, said permission table specifying a pteal pluraiity of 
mJ;\ iJn.si service applications and a type of data each individual application is allowed to 
receive, 

- means for allowing the service application to receive the requested user data if the 
assigned AUID code was included in the received user data request and if the service 
application is allowed to receive the user data according to the permission table, and 

- means for retrieving the requested user data based on a received AUID code and for 
sending the user data to the application; and 

- means for the service application to use the assigned AUID code to obtain the user data in 
conjunction with any subsequent service request from the mobile station. 



12. (CANCELLED) 
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13. (Previously Presented) A server according to claim 11, further comprising a translation 
table for storing the AUID code together with an identity of said mobile user and an identity 
of said service application. 

14. (Previously Presented) A server according to claim 13, further comprising a translator 
for translating AUID codes into mobile user identities and vice versa by checking the 
translation table. 

15. (Previously Presented) A server according to claim 11, wherein the code generating 
means is capable of generating new AUID codes by dividing the decimal representation of a 
non-periodic irrational number into blocks of a certain length, wherein each block is used as 
an AUID code. 

16. (Previously Presented) A server according to claim 11, further comprising a mobile 
network interface for receiving service requests from mobile users, and for retrieving user 
data. 

17. (Previously Presented) A server according to claim 11, further comprising an external 
provider interface for receiving requests for user data from service applications, and for 
responding with either the requested data or an appropriate error message. 

18. (Previously Presented) A computer program product comprising software code being 
adapted to perform the method of claim 1 in a data control server. 
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